Who is responsible for your data
Blessed Land is the controller of your personal data. That means we decide why and how it is processed, and we are responsible for it.
- Company: Blessed Land, established in Egypt.
- Address: Nasr City, at the intersection of Abbas El Akkad St. & Mostafa El Nahas St., St. 1, Cairo, Egypt.
- Privacy contact: support@philocoursa.com. Write "Privacy" in the subject line so your message reaches the right person quickly.
You can write to us in English, Arabic or Turkish. See our contact page for other ways to reach us.
What we collect, why, and on what legal basis
We collect only what we need to run Philocoursa. For each kind of data below you'll find what it is, why we use it, the legal basis under the GDPR, and how long we keep it. "Contract" means we need the data to provide the service you signed up for.
You need to give us your email address and a password (or use Google) to have an account; everything else is optional, but we can't build a course without a topic or syllabus.
Your account
- What: your name, email address, password (stored only as a secure hash, never in readable form), and, if you add one, your profile photo. If you sign in with Google, we receive your name, email address and Google profile picture link.
- Why: to create your account, sign you in, and contact you about your account.
- Legal basis: contract.
- Kept: until you delete your account.
Sign-in sessions and security
- What: a session record with the IP address and browser details (user agent) you signed in from; one-time links for verifying your email or resetting your password; rate-limit counters. The counters store your email and IP address only in a scrambled (hashed) form.
- Why: to keep you signed in, protect your account, and stop abuse such as password guessing.
- Legal basis: contract, and our legitimate interest in keeping the service secure.
- Kept: sessions end after 7 days, and expired sessions are cleared every few hours. A record of when you accepted our Terms and Privacy Policy (with a scrambled form of your IP address and your browser details) is kept until your account is deleted, as proof of your acceptance. One-time links expire quickly. Rate-limit counters last only for their short time window.
What you give us to build courses
- What: course titles, topics, goals, and any syllabus you type or upload (PDF, Word or text files), or a public web link you give us (we fetch that page and read its text), along with the text we extract from those files.
- Why: to plan and generate your course.
- Legal basis: contract.
- Kept: text you type is deleted when you delete the course. Uploaded files are stored apart from the course, and deleting a course does not remove them automatically. Email us and we delete them within 1 month, and we always delete them when you ask us to delete your account.
What we generate for you
- What: course plans, lesson briefs, handouts, slides and quizzes, plus the AI requests and responses that produced them, and token and cost figures for each request.
- Why: to show you your content, let you regenerate it, fix failures and refund credits when a generation fails.
- Legal basis: contract.
- Kept: until you delete the course. Token and cost figures with no content in them are kept, linked to your account, as long as accounting law requires.
Quiz answers
- What: the answers you type into quizzes, and the feedback and marks we generate.
- Why: to grade your answers and show you feedback.
- Legal basis: contract.
- Kept: until you delete the course or your account.
Credits and purchases
- What: your credit balance and a history of credits added and used. Credits never expire while your account exists. Once paid plans open, also the record of each purchase and refund: amount, currency, date and the payment provider's reference. We never see or store your full card number.
- Why: to run your credits, handle refunds, and meet tax and accounting rules.
- Legal basis: contract; legal obligation for purchase records.
- Kept: your credit history until you delete your account; purchase and refund records as long as tax and accounting law requires.
Topic suggestions
- What: which suggested topics you were shown and which ones you clicked.
- Why: to make the topic suggestions you see more useful, and, combined with other users' clicks without identifying anyone, to rank suggestions for everyone.
- Legal basis: our legitimate interest in improving suggestions for you. You can object at any time (see Your rights).
- Kept: until you delete your account.
Error reports and server logs
- What: technical details when something goes wrong, such as the page or feature, the error, timings, and sometimes an internal account number. We filter out passwords, tokens, cookies and web-address parameters, and on sign-in pages we also remove email addresses and form contents.
- Why: to find and fix bugs and keep the service running.
- Legal basis: our legitimate interest in a working, secure service.
- Kept: briefly. Server logs are rotated and overwritten automatically. Error reports are deleted by our error-monitoring provider within 90 days at most. Our error reports are stored in Sentry's EU region.
Messages you send us
- What: your emails to support, or messages through the in-app help form, and anything you include in them.
- Why: to answer you and handle your request.
- Legal basis: contract, or our legitimate interest in answering you; legal obligation for privacy requests.
- Kept: as long as needed to deal with your request, and to show how we handled it if it's ever questioned.
We don't collect sensitive data such as health, religion or political views, and we ask you not to put it in your courses or quizzes. We rely on consent only for things that are optional; today nothing in the service needs it. If we ever ask for consent, you can withdraw it at any time.
How AI processes your content
Philocoursa uses OpenAI's API to generate your courses and grade quiz answers. To do that we send OpenAI only what each task needs:
- your course topic and goal;
- your syllabus text, and text extracted from files you upload;
- the lesson context the AI needs, such as the course plan and earlier lessons;
- your quiz answers, when you ask for them to be graded.
We never send your name or email address to OpenAI. Anything you type into a topic, syllabus or answer is sent as you wrote it, so please leave out personal details that aren't needed.
- Training: OpenAI does not use data sent through its API to train its models, and neither do we.
- Retention at OpenAI: we ask OpenAI to keep each response on its systems so a long generation can finish reliably in the background. OpenAI keeps it for at least 30 days to run the service and monitor abuse, then deletes it under its own retention rules; we don't control the exact period. It does not use it to train its models. When you delete a course while it is still generating, we cancel its pending requests.
- Retention with us: we keep the AI requests and responses with your course, so we can show, repair and refund your work. When you delete a course, they are deleted with it. A technical copy of each raw AI reply that we keep in an internal delivery log is not removed automatically; email us and we delete it within 1 month, and we always delete it when you ask us to delete your account.
AI output can be wrong, incomplete or out of date. Please review it before you rely on it. See our Terms for more.
International transfers
Blessed Land is in Egypt, and some of our providers, including OpenAI, Cloudflare and Resend, are in the United States. Our hosting is in Europe, and Sentry stores error reports in its EU region. Your data may therefore be processed outside the country where you live.
- From the EU and EEA: we rely on an adequacy decision where one exists (including the EU–US Data Privacy Framework for certified providers), or otherwise on the European Commission's Standard Contractual Clauses.
- From the UK: we rely on UK adequacy regulations, or on the UK International Data Transfer Addendum to those clauses.
- From Egypt (our home law): we transfer data abroad under the safeguards that Egypt's Personal Data Protection Law (No. 151 of 2020) requires, and we are completing the licensing it asks of controllers.
- From anywhere else: we use the safeguards your local law requires, such as standard contracts.
You can ask us at support@philocoursa.com for a copy of the safeguards we rely on.
How long we keep your data
- Sign-in sessions: 7 days at most.
- Your account, courses and generated content: until you delete them or your account. Uploaded files: until we delete them on your request, as described above.
- Purchase and refund records: as long as tax and accounting law requires.
- Error reports and server logs: a short time, as described above.
- Backups: we take nightly encrypted backups and keep them on a rolling schedule. Data you delete in the app (such as a course) is removed from the live service at once. Data we delete for you on request (such as your account, uploaded files and exports) is removed within 1 month. Deleted data can remain in encrypted backups for up to 9 months until they roll off. If we ever restore a backup, we re-apply the deletions we have on record from before the restore, including every account deletion you asked us for.
Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you and give you a copy (access);
- correct data that is wrong or incomplete (rectification);
- delete your data (erasure);
- limit how we use your data while a concern is checked (restriction);
- give you your data in a machine-readable format, or send it to another provider (portability);
- stop using your data where we rely on legitimate interests (objection);
- withdraw any consent you gave, without affecting what we did before.
How to use your rights
- In the app: you can edit your name and photo and download each lesson's handout, slides and quiz. To get a full copy of your data, to delete your account, or to change your email address, email us from your account's address; we do it within 1 month and confirm when it's done. In-app tools for this will come later.
- By email: write to support@philocoursa.com. We may ask you to confirm your identity, usually by replying from your account's email address.
- We answer within 1 month. If a request is complex we may need up to 2 more months; we'll tell you within the first month if so.
- Using your rights is free. We won't treat you differently for using them.
If you're unhappy with how we handle your data
Please tell us first at support@philocoursa.com. We acknowledge every privacy complaint within 30 days and tell you what we did about it. You can also complain to a data protection authority at any time: in the UK, the Information Commissioner's Office (ICO); in the EU, the authority in the country where you live or work; in Egypt, the Personal Data Protection Center; elsewhere, your local data protection authority.
United States residents
If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to get a portable copy; and not to be discriminated against for using these rights.
- Categories we collect: identifiers (name, email, IP address, account number); commercial information (credits and purchases); internet activity (sign-in sessions, topic suggestions you click); and the content you provide.
- Sensitive information: we collect only your account login and password, and use them only to sign you in and keep your account secure.
- We don't sell or share personal information (as those terms are defined by these laws), we don't use it for targeted advertising, and we don't profile you in ways that produce legal or similarly significant effects. There is nothing to opt out of, but you can still contact us.
- You can use an authorised agent to make a request; we may ask the agent for proof and ask you to confirm your identity.
- If we refuse your request, you can appeal by replying to our answer or writing to support@philocoursa.com. If you're still unhappy, you can contact your state attorney general.
Egypt residents
Under the Personal Data Protection Law, you have the right to know about and access the data we hold about you, to get a copy, to withdraw your consent, to correct, update or erase your data, to object to or limit its processing, and to be told of any breach that affects it. Use these rights as described above.
Security and data breaches
We protect your data with measures that suit the risk, including:
- encrypted connections (HTTPS) between your browser and our service;
- passwords stored only as secure hashes;
- access to production systems limited to the people who need it;
- nightly encrypted off-site backups that we test restoring;
- rate limits against password guessing and abuse;
- error reports filtered to remove passwords, tokens and sign-in details.
No system is perfectly secure. If a personal data breach happens, we report it to the relevant authority within 72 hours where the law requires it, and we tell you without undue delay when it is likely to put you at high risk. We'll explain what happened, what data was involved and what you can do.
Keep your password to yourself. If you think someone else has used your account, change your password and tell us.
Children
Philocoursa is only for people aged 18 or older. We don't knowingly collect data from anyone younger. If we find that an account belongs to someone under 18, we close it and delete its data. If you think a child under 18 is using Philocoursa, please tell us at support@philocoursa.com.
Teachers who create courses for their students must have the authority to enter any student information, and should keep it to a minimum.
Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. AI grading of quiz answers is learning feedback for you; it isn't an official assessment or a decision about you, and nothing else in the service depends on it.
Do Not Track and Global Privacy Control
Some browsers send a Do Not Track or Global Privacy Control signal. We don't track you across other websites and we don't sell or share your data for advertising, so there's nothing for these signals to switch off. Our behaviour is the same whether or not your browser sends them.
Changes to this policy
When we update this policy, we change the effective date at the top. If a change is material, for example a new use of your data or a new kind of provider, we email you at least 30 days before it takes effect, and where the law requires your consent we ask for it. If you don't agree, you can close your account before the change takes effect, and unused paid credits are refunded as our Refund Policy describes.
Questions about this policy? Write to support@philocoursa.com.